CVE-2022-39346: Missing length validation of user displayname in nextcloud server
Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to 22.2.10, 23.0.7 or 24.0.3. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-39346?
CVE-2022-39346 is a vulnerability in Nextcloud server that could allow a malicious user to cause a denial of service by overloading the database.
How can this vulnerability be exploited?
This vulnerability can be exploited by a malicious user who can create user display names that overload the backing database, leading to a denial of service.
What versions of Nextcloud server are affected?
Versions up to and including 22.2.10 of Nextcloud Enterprise Server and Nextcloud Server are affected. Additionally, versions between 23.0.0 and 23.0.7, and versions between 24.0.0 and 24.0.3 of Nextcloud Enterprise Server and Nextcloud Server are also affected.
What is the severity of CVE-2022-39346?
The severity of CVE-2022-39346 is medium, with a CVSS score of 6.5.
How can I fix this vulnerability?
To fix this vulnerability, it is recommended to upgrade Nextcloud Server to version 22.2.11 or later.